Jerusalem is an early DOS file infector virus discovered in Israel in late 1987. Its origin is uncertain, as it was believed to have originated in Israel, but evidence from 1991 indicates that it may be from Italy. As of the year 1993, Jerusalem was still spreading in the wild and many variants have been created. The last reported Jerusalem incident was in 1995, nearly 8 years after it was first discovered. The virus has gone by many names, some that refer to its possible origin and its Friday the 13th payload date.

Behavior

Jerusalem infects both .com and .exe files under DOS. Upon execution, the virus becomes resident, staying in the memory even after the host program has been terminated. The virus then infects all programs that run after the first infected file is run. It copies a beginning portion of the target file (one that is as long as the virus) and adds it to the bottom of the file, while overwriting the beginning. The virus avoids COMMAND.COM.

Jerusalem delivers two payloads, one that is annoying but relatively harmless and the other destructive. The non-destructive one, which activates thirty minutes after the executed causes row 5 column 5 to row 16 column 16 on the screen are scrolled up two lines, creating a 'black window', then the system slows down due to a time-wasting loop installed on each timer interrupt. The destructive payload activates on any Friday the 13th, deleting any program run on that day.

The original Jerusalem and some early variants have a bug that causes them to infect files more than once, sometimes causing the files to consume all available storage space.

Variants

Over the years that Jerusalem spread, many virus coders created variants of the virus, making Jerusalem one of the largest families of viruses ever created. It even includes many sub-variants and a few sub-sub-variants. Most variants are unimaginative, simply changing the payload date, text displayed or even nothing at all. Some variants contain fixes for the bugs of the original.

Suriv

Suriv is older than the virus considered the original Jerusalem, but is still considered a part of the Jerusalem family because it is very similar, but never had Jerusalem's level of prominence. Suriv has three variants. Suriv.1 and 2 trigger their payloads on April 1 (a holiday for pranks in some western countries), while Suriv.3 activates on the 13th if the day is Friday. Some payloads of Suriv do not activate until after 1988. This virus has several variants from Argentina, but the originals come from Israel's Hebrew University.

Suriv.1

Suriv.1 is a .com infector, sometimes called April 1.com because of its payload activation date. Suriv.1 displays the payload "APRIL 1ST HA HA HA YOU HAVE A VIRUS".

Suriv.2

Suriv.2 is an .exe infector, sometimes called April 1.exe because of its payload activation date. Suriv.2 displays the payload "APRIL 1ST HA HA HA YOU HAVE A VIRUS". This is likely the first .exe infecting virus.

Suriv.3

This variant is able to infect both .com and .exe files. It may also be the first virus to infect both .com and .exe files.

Jerusalem-113

Programs will not run during Saturdays. The virus avoids PHENOME.COM instead of COMMAND.COM, and therefore infects COMMAND.COM.

Anarkia

The Anarkia variant uses the word "Anarkia" as its self-recognition code. Otherwise, it is completely identical to the original Jerusalem.

Apocalypse

Jerusalem.Apocalypse contains the text "Apocalypse!!". On Friday the 13th, if the virus is memory-resident, it will delete any file run.

Captain Trip

Jerusalem-Captain Trip contains the strings "Captain Trips" and "SPITFIRE".
If the year is any year other than 1990 and the day is a Friday on or after the 15th, if a program is run, Jerusalem-Captain Trip creates an empty file with the same name as the program. On several other dates it installs a routine in the timer tick that activates when 15 minutes pass. On the 16th Jerusalem-Captain Trip re-programs the video controller. Jerusalem-Captain Trip has several errors.

Carfield

The virus causes infected .com files to grow by 1,508 bytes, while .exe files grow by between 1,508 and 1,522 bytes. It takes up 1,744 bytes in memory.

If the day is Monday, if the virus is memory-resident, the computer will display the string "Carfield!" every 42 seconds.

Czech

On Friday the 13th, if the virus is memory-resident, it will delete any program run. Jerusalem.Czech has a self-recognition code and a code placement that differ from the original Jerusalem.

Frère

This variant and some sub-variants are reported to play tunes on a certain date. Frère.A plays Frère Jacques every 3 minutes and 45 seconds if the day is Friday or the 13th of any month. Jerusalem. Frère.B plays Frère Jacques every ten seconds.

Friday-15th (Skism)

Friday-15th causes infected files to grow by 1,813 bytes. On Friday the 15th, if the virus is memory-resident and a program is run, the virus will create a new file with the same name as the program.

FuManchu

The FuManchu variant is 2,086 bytes long and possibly comes from Britain. The creator of FuManchu eliminated some of the more destructive aspects contained in the original Jerusalem and other variants. The virus censors text containing four letter words and adds comments when the words "Reagan", "Thatcher", "Botha" and "Waldheim" are typed. When the user types "Control+Alt+Delete", the virus displays the message "The world will hear from me again!". It also contains some bug fixes of the original Jerusalem.

Jan25

On January the 25th, if the virus is memory-resident, it will delete any program run.

Jerusalem.J

Jeruspain (Jeru-Spanish)

If the virus is memory-resident, Jeruspain will delete any program if the program is run on the 26th of any month.

Mendoza

The virus does nothing if the year is 1980 or 1989. For all other years, if the virus is memory resident and if the floppy disk motor count is 25, a flag is set. The flag will be set if a program is run from a floppy disk. If the flag is set, every program which runs is deleted.If the flag is not set and 30 minutes passes, the cursor is changed to a block. After one hour, Caps Lock, Nums Lock, and Scroll Lock are switched to "Off".

Nemesis

Nov30

There is a 1 in 16 chance this version will infect a file when it executes.

PQSR

The PQSR variant causes infected files to grow by 1,720 bytes. In addition, any programs run on the thirteenth of any month regardless of the day are deleted. It uses "PQSR" as its self-recognition code.

Sunday

Files infected by the Sunday variant grow by 1,636 bytes. Every Sunday the virus displays one of three messages every 30 minutes.

Today is SunDay! Why do you work so hard?

All work and no play make you a dull boy!

Come on ! Let's go out and have some fun!

This variant also attempts to delete every program run, regardless of the day, but this variant contains bugs that prevent it from doing so. The Sunday variant also has some sub-variants and even sub-sub-variants.

Sunday.b

A version of Sunday which has a working program-deleting function.

Sunday.1.b

Similar to Sunday.b, except a bug regarding the Critical Error Handler, which causes problems on write-protected disks, has been fixed.

Sunday.1.d

Similar to Sunday.1.a, except the same bug is fixed in a different way.

Sunday.1.Tenseconds

Similar to Sunday.a, except the delay for the messages is now 10 seconds. In addition, the test for Sunday is correctly set for say 0 instead of 7.

Sunday.2

Similar to Sunday.1.a, except files grow by 1,733 bytes.

Jerusalem.T13

The virus causes .COM and .EXE files to grow by 1,812 bytes. On Tuesday the 13th, if the virus is memory-resident, it will delete any program run.

Westwood

The Westwood variant appeared in the Westwood district in Los Angeles, California. It is similar in most ways to the original Jerusalem. Westwood infects .ovl files in addition to .com and .exe files. It increases .exe and .ovl files by between 1,819 and 1,829 bytes and .com files by 1,829 bytes. Westwood was also coded with a fix for the bug that causes the original Jerusalem to continuously infect .exe files. This variant was not prevalent enough to be reported as wild by the WildList organization, and it is uncertain if it ever left the American state of California.

Yellow

Jerusalem-Yellow does not infect .exe files. All files infected grow by 1,363 bytes. After the virus is loaded into memory, when 45 minutes pass or when 4,096 keystrokes are entered, Jerusalem-Yellow creates a large yellow box with a shadow in the middle of the screen and the computer hangs.

Reported Variants

These variants has been reported to exist, but their existence cannot be confirmed. Some may be complete fiction, while others may simply be aliases of variants already listed here and a few may be variants that there is simply no information on. In order for these variants to be removed from this sub-heading and placed directly under "Variants", they will need a non-wiki source, preferably from a virus research group, university or antivirus product vendor.

Sat13

On Saturday the 13th, if the virus is memory-resident, it will delete any program run.

Jerusalem.T1

On Tuesday the 1st, if the virus is memory-resident, it will delete any file run.

Others

1af

2e7

52f

5a4

65d6

6d46

7c01

b0f

BSA

ffd

Mummy.1364.a

Not13

Standard.Var

Standard.AA33CCDDEE

Standard.UMsDos

Standard.Nocommand

sUMFDos

Turkish

Effects

Jerusalem became one of the most widespread viruses in history. Though it came into existence in 1987, it was still spreading into the mid-1990's. Little information is available on how high its damage totals are.

This virus came preinstalled in vendor software. These include a "Pumpkin Patch" screensaver and a PCNFS program from Sun Microsystems, in addition to a marketing company's demo disk which also contained Stoned. The Bupt variant was found on an America Online disk in June of 1995.

Names

Jerusalem could be considered the poster-child virus for a need for a consistent naming scheme among antivirus distributors. While the name "Jerusalem" eventually stuck and became the one most people use to refer to this virus, it went by many other names, many of them would have been in violation of the Computer Antivirus Research Organization (CARO) naming scheme created in 1991. Some of these names include: